Apple QuickTime H.264 Parsing Buffer Overflow Vulnerability

ID ZDI-06-015
Type zdi
Reporter ATmaCA
Modified 2006-06-22T00:00:00


This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple's QuickTime media player. The specific flaw exists within the parsing of H.264 content. The implicit trust of a user-supplied size value during a memory copy loop allows an attacker to create an exploitable memory corruption condition. Exploitation requires that an attacker either coerce the target to open a malformed media file or visit a website embedding the malicious file.